Interface Hooking

void *DetourCreate (BYTE *src, const BYTE *dst, const int len)
{
    BYTE *jmp = (BYTE*)malloc(len+5);
    DWORD dwback;
    VirtualProtect(src, len, PAGE_READWRITE, &dwback);
    memcpy(jmp, src, len); jmp += len;
    jmp[0] = 0xE9;
    *(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
    src[0] = 0xE9;
    *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
    VirtualProtect(src, len, dwback, &dwback);
    return (jmp-len);
}

//00457540  /$ 6A FF          PUSH -1
//00457542  |. 68 48296300    PUSH crossfir.00632948
//00457547  |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]             => EndScene Interface
//0045754D  |. 50             PUSH EAX
//0045754E  |. 51             PUSH ECX
//0045754F  |. 53             PUSH EBX
//00457550  |. A1 A0D56A00    MOV EAX,DWORD PTR DS:[6AD5A0]
//00457555  |. 33C4           XOR EAX,ESP
//00457557  |. 50             PUSH EAX
//00457558  |. 8D4424 0C      LEA EAX,DWORD PTR SS:[ESP+C]
//0045755C  |. 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
//00457562  |. 68 00C36C00    PUSH crossfir.006CC300                   ; /Arg1 = 006CC300
//00457567  |. 8D4C24 0C      LEA ECX,DWORD PTR SS:[ESP+C]             ; |
//0045756B  |. E8 700EFCFF    CALL crossfir.004183E0                   ; \crossfir.004183E0
//00457570  |. 33C9           XOR ECX,ECX
//00457572  |. 894C24 14      MOV DWORD PTR SS:[ESP+14],ECX
//00457576  |. 380D FCC26C00  CMP BYTE PTR DS:[6CC2FC],CL
//0045757C  |. 74 3D          JE SHORT crossfir.004575BB
//0045757E  |. A1 78C16C00    MOV EAX,DWORD PTR DS:[6CC178]
//00457583  |. 3BC1           CMP EAX,ECX
//00457585  |. 74 34          JE SHORT crossfir.004575BB
//00457587  |. 880D FCC26C00  MOV BYTE PTR DS:[6CC2FC],CL
//0045758D  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
//0045758F  |. 8B08           MOV ECX,DWORD PTR DS:[EAX]             => EndScene Engine
//00457591  |. 8B91 A8000000  MOV EDX,DWORD PTR DS:[ECX+A8]
//00457597  |. 50             PUSH EAX
//00457598  |. FFD2           CALL EDX
//0045759A  |. 85C0           TEST EAX,EAX
//0045759C  |. 8D4C24 08      LEA ECX,DWORD PTR SS:[ESP+8]
//004575A0  |. 0F94C3         SETE BL
//004575A3  |. E8 580EFCFF    CALL crossfir.00418400
//004575A8  |. 8AC3           MOV AL,BL
//004575AA  |. 8B4C24 0C      MOV ECX,DWORD PTR SS:[ESP+C]
//004575AE  |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
//004575B5  |. 59             POP ECX
//004575B6  |. 5B             POP EBX
//004575B7  |. 83C4 10        ADD ESP,10
//004575BA  |. C3             RETN
//004575BB  |> 8D4C24 08      LEA ECX,DWORD PTR SS:[ESP+8]
//004575BF  |. E8 3C0EFCFF    CALL crossfir.00418400
//004575C4  |. 32C0           XOR AL,AL
//004575C6  |. 8B4C24 0C      MOV ECX,DWORD PTR SS:[ESP+C]
//004575CA  |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
//004575D1  |. 59             POP ECX
//004575D2  |. 5B             POP EBX
//004575D3  |. 83C4 10        ADD ESP,10
//004575D6  \. C3             RETN

DWORD EndSceneInterface = 0x00457547;
DWORD retEndSceneInterface = (EndSceneInterface + 0x7);

__declspec(naked)HRESULT WINAPI EndSceneInterfaceMidfunction(VOID)
{
	static LPDIRECT3DDEVICE9 pDevice;

	__asm
	{
		MOV EAX, DWORD PTR FS:[0]
		PUSH EAX
		PUSHAD
	}

	pDevice = **(LPDIRECT3DDEVICE9 **)0x6CC178;

	// DrawBox(x, y, w, h, px, pDevice);

	__asm
	{
		POPAD
		JMP DWORD PTR DS:[retEndSceneInterface]
	}
}

DWORD WINAPI dwStartHook(PVOID)
{
	while(1)
	{
		if(memcmp((PVOID)EndSceneInterface, (PVOID)(PBYTE)"\x64\xA1", 2) == 0)
		{
			DetourCreate((PBYTE)EndSceneInterface, (PBYTE)EndSceneInterfaceMidfunction, 7);
		}
	}

	return FALSE;
}

//00579590  /. 55             PUSH EBP
//00579591  |. 8BEC           MOV EBP,ESP
//00579593  |. 51             PUSH ECX
//00579594  |. 833D 74856C00 >CMP DWORD PTR DS:[6C8574],0
//0057959B  |. 75 37          JNZ SHORT crossfir.005795D4
//0057959D  |. 6A 49          PUSH 49                                  ; /Arg1 = 00000049
//0057959F  |. E8 8C0D0600    CALL crossfir.005DA330                   ; \crossfir.005DA330
//005795A4  |. 83C4 04        ADD ESP,4
//005795A7  |. 833D F4E56B00 >CMP DWORD PTR DS:[6BE5F4],1
//005795AE  |. 7C 1D          JL SHORT crossfir.005795CD
//005795B0  |. 68 9C9D6600    PUSH crossfir.00669D9C                   ; /Arg4 = 00669D9C
//005795B5  |. 68 78AD6600    PUSH crossfir.0066AD78                   ; |Arg3 = 0066AD78 ASCII "LT_NOTINITIALIZED"
//005795BA  |. 68 58576700    PUSH crossfir.00675758                   ; |Arg2 = 00675758 ASCII "Start3D"
//005795BF  |. A1 30456B00    MOV EAX,DWORD PTR DS:[6B4530]            ; |
//005795C4  |. 50             PUSH EAX                                 ; |Arg1 => 00669D54 ASCII "LT ERROR: %s returned %s (%s)"
//005795C5  |. E8 56110600    CALL crossfir.005DA720                   ; \crossfir.005DA720
//005795CA  |. 83C4 10        ADD ESP,10
//005795CD  |> B8 49000000    MOV EAX,49
//005795D2  |. EB 29          JMP SHORT crossfir.005795FD
//005795D4  |> C745 FC 7C856C>MOV DWORD PTR SS:[EBP-4],crossfir.006C85>
//005795DB  |. 8B4D FC        MOV ECX,DWORD PTR SS:[EBP-4]
//005795DE  |. 8B11           MOV EDX,DWORD PTR DS:[ECX]
//005795E0  |. 83C2 01        ADD EDX,1
//005795E3  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
//005795E6  |. 8910           MOV DWORD PTR DS:[EAX],EDX
//005795E8  |. 833D 7C856C00 >CMP DWORD PTR DS:[6C857C],1
//005795EF  |. 74 04          JE SHORT crossfir.005795F5
//005795F1  |. 33C0           XOR EAX,EAX
//005795F3  |. EB 08          JMP SHORT crossfir.005795FD
//005795F5  |> FF15 CC856C00  CALL DWORD PTR DS:[6C85CC]               ;  crossfir.00457460
//005795FB  |. 33C0           XOR EAX,EAX
//005795FD  |> 8BE5           MOV ESP,EBP
//005795FF  |. 5D             POP EBP
//00579600  \. C3             RETN

DWORD Start3DEngine = 0x005795DB;
DWORD retStart3DEngine = (Start3DEngine + 0x14);

__declspec(naked)HRESULT WINAPI Start3DMidfunction(VOID)
{
	__asm
	{
		MOV ECX,DWORD PTR SS:[EBP-4]
		MOV EDX,DWORD PTR DS:[ECX]
		ADD EDX,1
		MOV EAX,DWORD PTR SS:[EBP-4]
		MOV DWORD PTR DS:[EAX],EDX
		CMP DWORD PTR DS:[0x6C857C],1
		PUSHAD
	}

	// funções ...

	//if(memcmp((PVOID)Start3DEngine, (PVOID)(PBYTE)"\x8B\x4D", 2) == 0)
	//{
	//	DetourCreate((PBYTE)Start3DEngine, (PBYTE)Start3DMidfunction, 14);
	//}

	__asm
	{
		POPAD
		JMP DWORD PTR DS:[retStart3DEngine]
	}
}